IOC Report
Confirmaci#U00f3n de pago_shrunk.exe

loading gif

Files

File Path
Type
Category
Malicious
Confirmaci#U00f3n de pago_shrunk.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Confirmaci#U00f3n de pago_shrunk.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Confirmaci#U00f3n de pago_shrunk.exe
"C:\Users\user\Desktop\Confirmaci#U00f3n de pago_shrunk.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
https://api.telegram.org/bot6828335029:AAHOq6iD_8Eg5u6FhmWF0NHPcKj1jLGtRk4/
unknown
 malicious
https://api.telegram.org
unknown
 malicious
https://api.telegram.org/bot6828335029:AAHOq6iD_8Eg5u6FhmWF0NHPcKj1jLGtRk4/sendDocument
149.154.167.220
 malicious
http://transfer.adttemp.com.br
unknown
https://account.dyn.com/
unknown
http://transfer.adttemp.com.brd
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://transfer.adttemp.com.br
unknown
https://transfer.adttemp.com.br/cCoB5/anonymous.txt
104.196.109.209

Domains

Name
IP
Malicious
api.telegram.org
149.154.167.220
 malicious
transfer.adttemp.com.br
104.196.109.209

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
104.196.109.209
transfer.adttemp.com.br
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Confirmaci#U00f3n de pago_shrunk_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
There are 19 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
313E000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
315A000
trusted library allocation
page read and write
 malicious
30F1000
trusted library allocation
page read and write
 malicious
3F89000
trusted library allocation
page read and write
 malicious
556E000
trusted library allocation
page read and write
5BA6000
trusted library allocation
page read and write
63B8000
heap
page read and write
1210000
heap
page read and write
5BB0000
trusted library allocation
page execute and read and write
5B8C000
trusted library allocation
page read and write
FDE000
heap
page read and write
66F0000
heap
page read and write
5B90000
heap
page read and write
4119000
trusted library allocation
page read and write
300A000
trusted library allocation
page read and write
620E000
stack
page read and write
11B1000
heap
page read and write
1170000
heap
page read and write
1075000
heap
page read and write
595E000
stack
page read and write
12A0000
heap
page read and write
2D5F000
stack
page read and write
5ADE000
stack
page read and write
317B000
trusted library allocation
page read and write
2E5C000
stack
page read and write
2FFA000
trusted library allocation
page read and write
2F70000
heap
page execute and read and write
65CE000
stack
page read and write
3142000
trusted library allocation
page read and write
1476000
heap
page read and write
556A000
trusted library allocation
page read and write
1496000
trusted library allocation
page execute and read and write
14A0000
trusted library allocation
page read and write
FB3000
heap
page read and write
6590000
trusted library allocation
page execute and read and write
62AE000
stack
page read and write
40F1000
trusted library allocation
page read and write
5F2E000
stack
page read and write
2F81000
trusted library allocation
page read and write
5350000
heap
page execute and read and write
66CE000
stack
page read and write
2BE7000
trusted library allocation
page execute and read and write
5B50000
trusted library allocation
page read and write
313C000
trusted library allocation
page read and write
5571000
trusted library allocation
page read and write
1460000
trusted library allocation
page read and write
30E0000
heap
page execute and read and write
118E000
stack
page read and write
69CE000
stack
page read and write
149A000
trusted library allocation
page execute and read and write
5B80000
trusted library allocation
page read and write
7F0A0000
trusted library allocation
page execute and read and write
55F0000
heap
page execute and read and write
1480000
trusted library allocation
page read and write
1325000
heap
page read and write
11AF000
heap
page read and write
5562000
trusted library allocation
page read and write
67F0000
heap
page read and write
3146000
trusted library allocation
page read and write
302E000
trusted library allocation
page read and write
F7E000
heap
page read and write
2D70000
heap
page read and write
63B0000
heap
page read and write
15C0000
heap
page read and write
63D0000
heap
page read and write
150E000
stack
page read and write
1200000
trusted library allocation
page read and write
141E000
stack
page read and write
2BF0000
trusted library allocation
page read and write
2BF2000
trusted library allocation
page read and write
5590000
trusted library allocation
page read and write
F20000
heap
page read and write
306E000
stack
page read and write
1139000
stack
page read and write
55DE000
stack
page read and write
606E000
stack
page read and write
634E000
stack
page read and write
3169000
trusted library allocation
page read and write
5650000
heap
page read and write
400000
remote allocation
page execute and read and write
FA4000
heap
page read and write
1320000
heap
page read and write
B02000
unkown
page readonly
1490000
trusted library allocation
page read and write
2C10000
trusted library allocation
page read and write
B16000
unkown
page readonly
2F5E000
stack
page read and write
56DE000
stack
page read and write
648C000
stack
page read and write
14C0000
trusted library allocation
page read and write
30AC000
stack
page read and write
5582000
trusted library allocation
page read and write
3014000
trusted library allocation
page read and write
6AE0000
heap
page read and write
3000000
trusted library allocation
page read and write
5556000
trusted library allocation
page read and write
65C0000
trusted library allocation
page read and write
60CE000
stack
page read and write
5BFD000
stack
page read and write
2EC8000
trusted library allocation
page read and write
65D0000
trusted library allocation
page read and write
F97000
heap
page read and write
1203000
trusted library allocation
page execute and read and write
1024000
heap
page read and write
2BF7000
trusted library allocation
page execute and read and write
658E000
stack
page read and write
563C000
stack
page read and write
585E000
stack
page read and write
30B0000
heap
page read and write
52D0000
trusted library allocation
page read and write
555E000
trusted library allocation
page read and write
1290000
heap
page read and write
1201000
heap
page read and write
5A9E000
stack
page read and write
B00000
unkown
page readonly
51ED000
stack
page read and write
5C6E000
stack
page read and write
30D0000
trusted library allocation
page execute and read and write
531E000
stack
page read and write
1464000
trusted library allocation
page read and write
66E0000
heap
page read and write
3156000
trusted library allocation
page read and write
65B7000
trusted library allocation
page read and write
5540000
trusted library allocation
page read and write
123F000
heap
page read and write
2C5E000
stack
page read and write
F30000
heap
page read and write
2BE0000
trusted library allocation
page read and write
11A4000
heap
page read and write
F70000
heap
page read and write
2BE2000
trusted library allocation
page read and write
581E000
stack
page read and write
F50000
heap
page read and write
571D000
stack
page read and write
14A5000
trusted library allocation
page execute and read and write
1038000
heap
page read and write
65A0000
trusted library allocation
page read and write
30FA000
trusted library allocation
page read and write
5B59000
trusted library allocation
page read and write
5BDF000
stack
page read and write
1070000
heap
page read and write
5530000
trusted library allocation
page read and write
5550000
trusted library allocation
page read and write
61CD000
stack
page read and write
1510000
heap
page read and write
1463000
trusted library allocation
page execute and read and write
6ACF000
stack
page read and write
658C000
stack
page read and write
2BFB000
trusted library allocation
page execute and read and write
6433000
heap
page read and write
557D000
trusted library allocation
page read and write
644D000
stack
page read and write
5640000
heap
page read and write
65B0000
trusted library allocation
page read and write
2F60000
heap
page read and write
B14000
unkown
page readonly
11CE000
stack
page read and write
5ACF000
stack
page read and write
1204000
trusted library allocation
page read and write
5BA0000
trusted library allocation
page read and write
15B0000
trusted library allocation
page read and write
30ED000
trusted library allocation
page read and write
2BEA000
trusted library allocation
page execute and read and write
59CE000
stack
page read and write
120D000
trusted library allocation
page execute and read and write
598E000
stack
page read and write
2F60000
trusted library allocation
page read and write
1259000
heap
page read and write
1058000
heap
page read and write
5643000
heap
page read and write
584C000
stack
page read and write
148D000
trusted library allocation
page execute and read and write
14AB000
trusted library allocation
page execute and read and write
1470000
heap
page read and write
4159000
trusted library allocation
page read and write
3003000
trusted library allocation
page read and write
3F81000
trusted library allocation
page read and write
1450000
trusted library allocation
page read and write
301B000
trusted library allocation
page read and write
599E000
stack
page read and write
64EE000
stack
page read and write
68CE000
stack
page read and write
5B0D000
stack
page read and write
2D60000
trusted library allocation
page execute and read and write
66D0000
heap
page read and write
131F000
stack
page read and write
14A2000
trusted library allocation
page read and write
55A0000
trusted library allocation
page read and write
5F6E000
stack
page read and write
14A7000
trusted library allocation
page execute and read and write
EF8000
stack
page read and write
1492000
trusted library allocation
page read and write
1179000
heap
page read and write
11F0000
trusted library allocation
page read and write
555B000
trusted library allocation
page read and write
5576000
trusted library allocation
page read and write
3176000
trusted library allocation
page read and write
559E000
stack
page read and write
30F8000
trusted library allocation
page read and write
630E000
stack
page read and write
146D000
trusted library allocation
page execute and read and write
588E000
stack
page read and write
5E2E000
stack
page read and write
5330000
trusted library allocation
page read and write
6B20000
heap
page read and write
3012000
trusted library allocation
page read and write
BBC000
stack
page read and write
5D6C000
stack
page read and write
6AF0000
trusted library allocation
page execute and read and write
1039000
stack
page read and write
302A000
trusted library allocation
page read and write
There are 202 hidden memdumps, click here to show them.